CVE-2026-105117 OpenAM before 16.1.3 Email Content Injection via Users REST Self-Service Actions

OpenAM before 16.1.3 contains an email content injection vulnerability that allows unauthenticated attackers to control notification email wording via the forgotPassword and register actions on /json/realm/users. Attackers can supply subject and message fields to send phishing mail from the...

[SECURITY] Fedora 45 Update: caja-actions-1.28.0-11.fc45

Caja actions is an extension for Caja, the MATE file manager. It provides an easy way to configure programs to be launch on files selected in Caja interface...

CVE-2026-104873 LangGraph SDK custom auth silently ignores actions= on resource decorators

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From 0.1.45 until 0.4.4, the langgraph-sdk resource-scoped authorization decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons ignore the...

CVE-2026-104873 LangGraph SDK custom auth silently ignores actions= on resource decorators

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From 0.1.45 until 0.4.4, the langgraph-sdk resource-scoped authorization decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons ignore the...

CVE-2026-101104

The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate configurations of devices they do not own. By exploiting this flaw, an attacker can alter device settings, trigger unintended behaviors, or access sensitive informatio...

CVE-2026-104450

YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action tools/attach/actions/pointimage.php, which saves content to an attacker-chosen page with write ACL checks bypassed. Unauthenticated attackers can POST pagetag, title, and description fields to any page rendering...

CVE-2026-104460 YesWiki before 4.6.7 Unauthenticated Blind SQL Injection via newtextsearch

YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the newtextsearch action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without escaping. Anonymous attackers can plant a malicious option id in an anonymously editable...

CVE-2026-104460

Versions of YesWiki prior to 4.6.7 are vulnerable to a blind SQL injection within the {{newtextsearch}} action. The root cause is the concatenation of Bazar list option ids into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without proper escaping. This allows anonymous attackers to plant ...

CVE-2026-104460 YesWiki before 4.6.7 Unauthenticated Blind SQL Injection via newtextsearch

YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the newtextsearch action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without escaping. Anonymous attackers can plant a malicious option id in an anonymously editable...

CVE-2026-104460 YesWiki before 4.6.7 Unauthenticated Blind SQL Injection via newtextsearch

YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the newtextsearch action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without escaping. Anonymous attackers can plant a malicious option id in an anonymously editable...

CVE-2026-104450 YesWiki before 4.6.7 ACL Bypass and Stored XSS via pointimage Action

YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action tools/attach/actions/pointimage.php, which saves content to an attacker-chosen page with write ACL checks bypassed. Unauthenticated attackers can POST pagetag, title, and description fields to any page rendering...

CVE-2026-104450 YesWiki before 4.6.7 ACL Bypass and Stored XSS via pointimage Action

YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action tools/attach/actions/pointimage.php, which saves content to an attacker-chosen page with write ACL checks bypassed. Unauthenticated attackers can POST pagetag, title, and description fields to any page rendering...

CVE-2026-104450 YesWiki before 4.6.7 ACL Bypass and Stored XSS via pointimage Action

YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action tools/attach/actions/pointimage.php, which saves content to an attacker-chosen page with write ACL checks bypassed. Unauthenticated attackers can POST pagetag, title, and description fields to any page rendering...

EUVD-2026-91461

YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action tools/attach/actions/pointimage.php, which saves content to an attacker-chosen page with write ACL checks bypassed. Unauthenticated attackers can POST pagetag, title, and description fields to any page rendering...

CVE-2026-104450

YesWiki versions before 4.6.7 are vulnerable to a missing authorization flaw in the pointimage action (tools/attach/actions/pointimage.php ). This flaw allows unauthenticated attackers to bypass write Access Control List (ACL) checks by sending POST requests with pagetag, title, and description f...

Unauthenticated Administrative REST API Access in Brocade ASCG before 3.5.0 (CVE-2026-85489)

An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including accessing sensitive system configuration mapping data, modifying managed device inventories, and...

CVE-2026-104450: Improper Neutralization of Input During Web Page Generation

YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action tools/attach/actions/pointimage.php, which saves content to an attacker-chosen page with write ACL checks bypassed. Unauthenticated attackers can POST pagetag, title, and description fields to any page rendering...

PT-2026-104260

YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action tools/attach/actions/pointimage.php, which saves content to an attacker-chosen page with write ACL checks bypassed. Unauthenticated attackers can POST pagetag, title, and description fields to any page rendering...

PT-2026-104270

YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the newtextsearch action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without escaping. Anonymous attackers can plant a malicious option id in an anonymously editable...

CVE-2026-104460: Improper Neutralization of Special Elements used in an SQL Command

YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the newtextsearch action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without escaping. Anonymous attackers can plant a malicious option id in an anonymously editable...